Sometimes, I kind of miss the oh-too-obvious spam emails that were once the norm. You know, the kind that were supposedly from some usurped royal who needed your assistance to reclaim their rightful place on the throne, or from some absurdly attractive individual who seemed to be coming on to you. Sure, at the time it was annoying, but compared to today’s spam…
Well, it was a simpler time.
Unfortunately, the reason those old scams were common enough to become semi-fond memories is that, on occasion, they worked.
People fell for these kinds of scams all the time, sending money out with the expectation that huge sums would come flowing back. Hopeful singles would reach out in the hope that they’d stumbled across true love (and all the perks that implied).
Success is what makes spammers continue today. For them, it’s all a big numbers game: some percentage of users will fall for different types of spam campaigns, and scammers now know the tricks to improve their conversion rates. Spam is a formula: x-number of emails equals y percent of successful victims—they just need to solve for x.
If you’re going to protect your business from these attacks and scams, you need to know the kind of tactics to keep an eye out for.
Email Spoofing
Some unknown sender is one thing, but surely a dangerous email wouldn’t come from Amazon, PayPal, Google, your mother, the bank, your employer, or someone like that…would it?
Unfortunately, spam can now be spread that is designed to mimic what you’d expect to see from a trusted email address. Posing as a legitimate business has been part of the spam and phishing playbook for quite some time, as they are highly scalable and applicable to most people. Chances are pretty good that any given person will have an Amazon or Google account nowadays, after all.
Otherwise, these attacks can be far more targeted. Let’s say your bank had its member contact list stolen in a data breach. That list gives a scammer all they need to target your bank’s members with a convincing and effective scam, customized to them.
Social media is also a useful tool. A scammer could find a potential target, their contact information, the people in their life whom the target would be most likely to help, and their contact information. At that point, a little technical knowledge is all that a scammer needs to run extremely personalized campaigns.
Homograph and Punycode Attacks
“Tear.”
Now, what did you read that word as? Did you read “tear,” as in the act of ripping something, or “tear,” the thing that comes out of your eyes when you’re hurt or sad?
This is what is known as a homograph, the phenomenon where two different words are spelled the same but have different meanings. In terms of scams, homograph attacks are used to trick a user into trusting an email or website URL by making it look like a different one. Basically, non-traditional keyboard characters are translated to look like familiar ones, which makes it easier for an attacker to spoof a well-known domain or legitimate-looking email address without actually owning it.
Homograph and Punycode attacks aren’t exclusive to email, as we alluded to above. Fake websites that look legitimate can be built to steal information, and links can be shared through messaging apps and social media. Unfortunately, this means you effectively need to be on your guard when it comes to any activity or correspondence.
Email Compromise
An entire email inbox can be leveraged by a cybercriminal as a weapon—and it’s actually one of the oldest means used to distribute malware and spam, even to this day. If your password is stolen or too weak, or malware happens to sneak in, your email can be compromised and used to propagate the threat by sending emails out to your contact lists.
Since these emails come from your account, most recipients will see them to be legitimate and open them. Once they do, the process repeats, exponentially spreading.
If someone isn’t as focused on their cybersecurity hygiene as they should be, a hacker can have a very easy time accessing their email.
For instance, let’s say that Jason uses the same password on his work email and his Amazon Prime account. His kids use his password to access Amazon Video to watch The Boys and The Rings of Power, but one day, malware infects his son’s tablet and steals the password. As a result, Jason’s user credentials are up for sale on the Dark Web, along with the tens of thousands of other credentials this malware has stolen. On sale for pennies on the dollar, scammers and cybercriminals from all over are able to access and utilize it. It doesn’t take long for them to start trying these username and password combinations in other places, and before long, Jason’s work email is breached.
From there, an attacker can email contacts, of course, read messages, change any passwords to the accounts that tie to that email address, reset passwords, and more. Jason’s friends, family, coworkers, and clients are all scammed, expanding the attacker’s web of influence.
This goes the other way, too—your friends, family, and colleagues could cut corners with their cybersecurity, resulting in you being victimized as a result.
Skepticism and Awareness are Key to Preventing Cyberattacks and Scams
This should all go to show that scams and phishing attacks are increasingly difficult to spot, meaning that the most effective defense is an abundance of caution. We recommend what is called a zero-trust approach—if you didn’t specifically request an email attachment and did not expect one to accompany a message, don’t click on it or download it.
If your bank messages you regarding an unauthorized purchase, don’t panic. Instead, log into your bank account separately to check, not using any link received through the message.
Make sure you cultivate this kind of cautious culture in your business, too. If you send someone an email with an attachment, shoot them a quick phone call or instant message to let them know it’s on its way. Even internally, acting with security coming first in your correspondence is a wise policy.
Encourage your team to act safely concerning their email, and it will pay off—period.
Our technicians are here to help your team members, including with your email security. If a team member receives a suspicious email, we can check it out for you. Give us a call today at 800.618.9844.
